JWT Decoder
Decode and inspect a JSON Web Token's header, payload and expiry. The token stays in this page — it is never sent anywhere.
What a JWT is made of
Three Base64url segments separated by dots. The header names the signing algorithm, the payload carries the claims — subject, issuer, expiry, whatever your system adds — and the signature proves the first two have not been altered by anyone lacking the key. Only the signature is protected. The payload is not secret: anyone holding the token can read every claim in it, which is why personal data does not belong there.
Why you should not paste a live token into a hosted decoder
A production JWT is a bearer credential. Whoever holds it can act as the user it identifies until it expires. Paste one into a decoder that posts to a server and you have handed a working credential to a third party and written it into their request logs — where it will sit long after you have closed the tab, and where it remains valid for the rest of its lifetime.
This decoder splits and Base64url-decodes the token in the page. There is no request, and therefore no log. If you have already pasted a production token somewhere else, the correct response is to rotate it rather than hope.
Common questions
Is it safe to paste a production JWT into an online decoder?
Not into one that decodes server-side — the token is a working credential and it ends up in that server's logs. Only use a decoder that runs in your browser, and verify it with the DevTools Network tab before trusting it.
Can this tool verify the signature?
No, and deliberately so: verifying requires the signing key, and pasting a signing key into a web page is a worse idea than pasting the token. This decoder shows you the header, claims and expiry.
Is the payload encrypted?
No. A standard JWT payload is only Base64url-encoded and is readable by anyone holding the token. Never put personal or secret data in it.